4.3. Creating an Azure AD application

Procedure

1. From any node in the HA cluster, log in to your Azure account:

   $ az login

2. Create a json configuration file for a custom role for the Azure fence agent. Use the following configuration, but replace <subscription_id> with your subscription IDs:

   {
         "Name": "Linux Fence Agent Role",
         "description": "Allows to power-off and start virtual machines",
         "assignableScopes": [
                 "/subscriptions/<subscription_id>"
         ],
         "actions": [
                 "Microsoft.Compute/*/read",
                 "Microsoft.Compute/virtualMachines/powerOff/action",
                 "Microsoft.Compute/virtualMachines/start/action"
         ],
         "notActions": [],
         "dataActions": [],
         "notDataActions": []
   }

3. Define the custom role for the Azure fence agent. Use the json file created in the earlier step:

   $ az role definition create --role-definition <azure_fence_role.json>
   
   {
     "assignableScopes": [
       "/subscriptions/<my_subscription_id>"
     ],
     "description": "Allows to power-off and start virtual machines",
     "id": "/subscriptions/<my_subscription_id>/providers/Microsoft.Authorization/roleDefinitions/<role_id>",
     "name": "<role_id>",
     "permissions": [
       {
         "actions": [
           "Microsoft.Compute/*/read",
           "Microsoft.Compute/virtualMachines/powerOff/action",
           "Microsoft.Compute/virtualMachines/start/action"
         ],
         "dataActions": [],
         "notActions": [],
         "notDataActions": []
       }
     ],
     "roleName": "Linux Fence Agent Role",
     "roleType": "CustomRole",
     "type": "Microsoft.Authorization/roleDefinitions"
   }

4. In the Azure web console interface, select Virtual Machine click Identity in the left-side menu.
5. Select On click Save click Yes to confirm.
6. Click Azure role assignments Add role assignment.
7. Select the Scope required for the role, for example Resource Group.
8. Select the required Resource Group.
9. Optional: Change the Subscription if necessary.
10. Select the Linux Fence Agent Role role.
11. Click Save.